eslint-plugin-jwt-security 2.3.0 → 2.3.2

package/src/utils/index.ts

@@ -1,285 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-
-/**
- * Shared utilities for JWT security rules
- *
- * Library detection, pattern matching, and common helpers.
- */
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-/**
- * Supported JWT libraries
- */
-export const JWT_LIBRARIES = {
-  JSONWEBTOKEN: 'jsonwebtoken',
-  JOSE: 'jose',
-  EXPRESS_JWT: 'express-jwt',
-  NESTJS_JWT: '@nestjs/jwt',
-  JWKS_RSA: 'jwks-rsa',
-  JWT_DECODE: 'jwt-decode',
-} as const;
-
-export type JwtLibrary = (typeof JWT_LIBRARIES)[keyof typeof JWT_LIBRARIES];
-
-/**
- * Insecure algorithms that should be flagged
- */
-export const INSECURE_ALGORITHMS = new Set([
-  'none',
-  'None',
-  'NONE',
-  'HS256', // Only insecure when used with public keys
-  'HS384',
-  'HS512',
-]);
-
-/**
- * Algorithms vulnerable to confusion attacks when used with asymmetric keys
- */
-export const SYMMETRIC_ALGORITHMS = new Set(['HS256', 'HS384', 'HS512']);
-
-/**
- * Recommended secure algorithms
- */
-export const SECURE_ALGORITHMS = new Set([
-  'RS256',
-  'RS384',
-  'RS512',
-  'ES256',
-  'ES384',
-  'ES512',
-  'PS256',
-  'PS384',
-  'PS512',
-  'EdDSA',
-]);
-
-/**
- * Sensitive field names that should not be in JWT payload
- * All lowercase for case-insensitive matching
- */
-export const SENSITIVE_PAYLOAD_FIELDS = new Set([
-  // Passwords
-  'password', 'passwd', 'pwd', 'pass', 'secret',
-  // API Keys
-  'apikey', 'api_key', 'api-key',
-  'apisecret', 'api_secret', 'api-secret',
-  // Tokens
-  'accesstoken', 'access_token', 'access-token',
-  'refreshtoken', 'refresh_token', 'refresh-token',
-  'bearertoken', 'bearer_token', 'bearer-token',
-  // Keys
-  'privatekey', 'private_key', 'private-key',
-  'secretkey', 'secret_key', 'secret-key',
-  // PII - Personal Identifiable Information
-  'email', 'emailaddress', 'email_address', 'email-address',
-  'phone', 'phonenumber', 'phone_number', 'phone-number',
-  'ssn', 'socialsecuritynumber', 'social_security_number',
-  'dob', 'dateofbirth', 'date_of_birth', 'birthdate',
-  'address', 'streetaddress', 'street_address',
-  // Financial
-  'creditcard', 'credit_card', 'credit-card',
-  'cardnumber', 'card_number', 'card-number',
-  'cvv', 'cvc', 'securitycode', 'security_code',
-  'pin', 'pincode', 'pin_code',
-  'bankaccount', 'bank_account', 'bank-account',
-  'accountnumber', 'account_number', 'account-number',
-  'routingnumber', 'routing_number', 'routing-number',
-]);
-
-/**
- * JWT method patterns for different operations
- */
-export const JWT_METHODS = {
-  SIGN: new Set(['sign', 'signJWT', 'SignJWT']),
-  VERIFY: new Set(['verify', 'verifyJWT', 'jwtVerify']),
-  DECODE: new Set(['decode', 'jwtDecode', 'decodeJWT']),
-} as const;
-
-/**
- * Check if a node represents a call to a JWT library method
- */
-export function isJwtLibraryCall(
-  node: TSESTree.CallExpression,
-  targetMethods: Set<string>
-): boolean {
-  // Check member expression: jwt.verify(), jose.jwtVerify()
-  if (node.callee.type === 'MemberExpression') {
-    const property = node.callee.property;
-    if (property.type === 'Identifier') {
-      return targetMethods.has(property.name);
-    }
-  }
-
-  // Check direct calls: jwtVerify(), jwtDecode()
-  if (node.callee.type === 'Identifier') {
-    return targetMethods.has(node.callee.name);
-  }
-
-  return false;
-}
-
-/**
- * Check if a node is a string literal with a specific value
- */
-export function isStringLiteral(
-  node: TSESTree.Node,
-  value?: string
-): node is TSESTree.Literal {
-  if (node.type !== 'Literal' || typeof node.value !== 'string') {
-    return false;
-  }
-  return value === undefined || node.value === value;
-}
-
-/**
- * Extract algorithm from options object
- */
-export function extractAlgorithms(
-  optionsNode: TSESTree.ObjectExpression
-): string[] {
-  const algorithms: string[] = [];
-
-  for (const prop of optionsNode.properties) {
-    if (prop.type !== 'Property' || prop.key.type !== 'Identifier') {
-      continue;
-    }
-
-    const keyName = prop.key.name;
-    if (keyName !== 'algorithms' && keyName !== 'algorithm' && keyName !== 'alg') {
-      continue;
-    }
-
-    // Single algorithm: { algorithm: 'HS256' }
-    if (prop.value.type === 'Literal' && typeof prop.value.value === 'string') {
-      algorithms.push(prop.value.value);
-    }
-
-    // Array of algorithms: { algorithms: ['RS256', 'ES256'] }
-    if (prop.value.type === 'ArrayExpression') {
-      for (const elem of prop.value.elements) {
-        if (elem && elem.type === 'Literal' && typeof elem.value === 'string') {
-          algorithms.push(elem.value);
-        }
-      }
-    }
-  }
-
-  return algorithms;
-}
-
-/**
- * Check if options object has a specific property set
- */
-export function hasOption(
-  optionsNode: TSESTree.ObjectExpression,
-  optionName: string
-): boolean {
-  return optionsNode.properties.some(
-    (prop): prop is TSESTree.Property =>
-      prop.type === 'Property' &&
-      prop.key.type === 'Identifier' &&
-      prop.key.name === optionName
-  );
-}
-
-/**
- * Get the value of a specific option from options object
- */
-export function getOptionValue(
-  optionsNode: TSESTree.ObjectExpression,
-  optionName: string
-): TSESTree.Node | undefined {
-  for (const prop of optionsNode.properties) {
-    if (
-      prop.type === 'Property' &&
-      prop.key.type === 'Identifier' &&
-      prop.key.name === optionName
-    ) {
-      return prop.value;
-    }
-  }
-  return undefined;
-}
-
-/**
- * Check if a literal appears to be a weak secret (short string)
- */
-export function isWeakSecret(
-  node: TSESTree.Node,
-  minLength = 32
-): boolean {
-  if (node.type === 'Literal' && typeof node.value === 'string') {
-    return node.value.length < minLength;
-  }
-  return false;
-}
-
-/**
- * Check if a node is an environment variable access (safe pattern)
- */
-export function isEnvVariable(node: TSESTree.Node): boolean {
-  // process.env.JWT_SECRET
-  if (
-    node.type === 'MemberExpression' &&
-    node.object.type === 'MemberExpression' &&
-    node.object.object.type === 'Identifier' &&
-    node.object.object.name === 'process' &&
-    node.object.property.type === 'Identifier' &&
-    node.object.property.name === 'env'
-  ) {
-    return true;
-  }
-
-  return false;
-}
-
-/**
- * Check if this call looks like a JWT sign operation
- */
-export function isSignOperation(node: TSESTree.CallExpression): boolean {
-  return isJwtLibraryCall(node, JWT_METHODS.SIGN);
-}
-
-/**
- * Check if this call looks like a JWT verify operation
- */
-export function isVerifyOperation(node: TSESTree.CallExpression): boolean {
-  return isJwtLibraryCall(node, JWT_METHODS.VERIFY);
-}
-
-/**
- * Check if this call looks like a JWT decode operation (no verification)
- */
-export function isDecodeOperation(node: TSESTree.CallExpression): boolean {
-  return isJwtLibraryCall(node, JWT_METHODS.DECODE);
-}
-
-/**
- * Get the options argument from a JWT call
- * For jwt.verify(token, secret, options) -> returns options
- * For jwt.sign(payload, secret, options) -> returns options
- */
-export function getOptionsArgument(
-  node: TSESTree.CallExpression,
-  optionsIndex = 2
-): TSESTree.ObjectExpression | undefined {
-  const arg = node.arguments[optionsIndex];
-  if (arg && arg.type === 'ObjectExpression') {
-    return arg;
-  }
-  return undefined;
-}
-
-/**
- * Check if file is a test file
- */
-export function isTestFile(filename: string): boolean {
-  return /\.(test|spec)\.[jt]sx?$/.test(filename) ||
-         /__(tests?|mocks?)__/.test(filename) ||
-         /\/(tests?|specs?|__tests__)\//.test(filename);
-}

package/src/utils/utils.test.ts

@@ -1,324 +0,0 @@
-/**
- * Tests for JWT utilities
- */
-import { describe, it, expect } from 'vitest';
-import {
-  isJwtLibraryCall,
-  isStringLiteral,
-  extractAlgorithms,
-  hasOption,
-  getOptionValue,
-  isWeakSecret,
-  isEnvVariable,
-  isSignOperation,
-  isVerifyOperation,
-  isDecodeOperation,
-  getOptionsArgument,
-  isTestFile,
-  SENSITIVE_PAYLOAD_FIELDS,
-  SYMMETRIC_ALGORITHMS,
-  SECURE_ALGORITHMS,
-  INSECURE_ALGORITHMS,
-  JWT_LIBRARIES,
-} from './index';
-import type { TSESTree } from '@interlace/eslint-devkit';
-
-// Helper to create mock nodes
-function mockCallExpression(calleeName: string): TSESTree.CallExpression {
-  return {
-    type: 'CallExpression',
-    callee: { type: 'Identifier', name: calleeName } as TSESTree.Identifier,
-    arguments: [],
-  } as unknown as TSESTree.CallExpression;
-}
-
-function mockMemberCallExpression(objectName: string, methodName: string): TSESTree.CallExpression {
-  return {
-    type: 'CallExpression',
-    callee: {
-      type: 'MemberExpression',
-      object: { type: 'Identifier', name: objectName } as TSESTree.Identifier,
-      property: { type: 'Identifier', name: methodName } as TSESTree.Identifier,
-    },
-    arguments: [],
-  } as unknown as TSESTree.CallExpression;
-}
-
-function mockLiteral(value: string | number | boolean): TSESTree.Literal {
-  return {
-    type: 'Literal',
-    value,
-  } as TSESTree.Literal;
-}
-
-function mockObjectExpression(props: Record<string, TSESTree.Node>): TSESTree.ObjectExpression {
-  return {
-    type: 'ObjectExpression',
-    properties: Object.entries(props).map(([key, value]) => ({
-      type: 'Property',
-      key: { type: 'Identifier', name: key } as TSESTree.Identifier,
-      value,
-    })),
-  } as unknown as TSESTree.ObjectExpression;
-}
-
-describe('JWT Utils', () => {
-  describe('isJwtLibraryCall', () => {
-    it('should detect direct calls', () => {
-      const call = mockCallExpression('verify');
-      expect(isJwtLibraryCall(call, new Set(['verify']))).toBe(true);
-    });
-
-    it('should detect member calls', () => {
-      const call = mockMemberCallExpression('jwt', 'verify');
-      expect(isJwtLibraryCall(call, new Set(['verify']))).toBe(true);
-    });
-
-    it('should return false for non-matching calls', () => {
-      const call = mockCallExpression('somethingElse');
-      expect(isJwtLibraryCall(call, new Set(['verify']))).toBe(false);
-    });
-
-    it('should return false for non-identifier/member callee (line 117)', () => {
-      // This covers the `return false` at line 117 for CallExpression, ArrowFunction, etc.
-      const call = {
-        type: 'CallExpression',
-        callee: { type: 'ArrowFunctionExpression' }, // Not Identifier or MemberExpression
-        arguments: [],
-      } as unknown as TSESTree.CallExpression;
-      expect(isJwtLibraryCall(call, new Set(['verify']))).toBe(false);
-    });
-
-    it('should return false for member with non-identifier property', () => {
-      const call = {
-        type: 'CallExpression',
-        callee: {
-          type: 'MemberExpression',
-          object: { type: 'Identifier', name: 'jwt' },
-          property: { type: 'Literal', value: 'verify' }, // Literal, not Identifier
-        },
-        arguments: [],
-      } as unknown as TSESTree.CallExpression;
-      expect(isJwtLibraryCall(call, new Set(['verify']))).toBe(false);
-    });
-  });
-
-  describe('isStringLiteral', () => {
-    it('should return true for string literals', () => {
-      const literal = mockLiteral('hello');
-      expect(isStringLiteral(literal)).toBe(true);
-    });
-
-    it('should return true when value matches', () => {
-      const literal = mockLiteral('test');
-      expect(isStringLiteral(literal, 'test')).toBe(true);
-    });
-
-    it('should return false when value does not match', () => {
-      const literal = mockLiteral('test');
-      expect(isStringLiteral(literal, 'other')).toBe(false);
-    });
-
-    it('should return false for non-string literals', () => {
-      const literal = mockLiteral(123);
-      expect(isStringLiteral(literal)).toBe(false);
-    });
-  });
-
-  describe('extractAlgorithms', () => {
-    it('should extract single algorithm', () => {
-      const obj = mockObjectExpression({
-        algorithm: mockLiteral('HS256'),
-      });
-      expect(extractAlgorithms(obj)).toEqual(['HS256']);
-    });
-
-    it('should extract algorithms from array', () => {
-      const obj = {
-        type: 'ObjectExpression',
-        properties: [{
-          type: 'Property',
-          key: { type: 'Identifier', name: 'algorithms' },
-          value: {
-            type: 'ArrayExpression',
-            elements: [mockLiteral('RS256'), mockLiteral('ES256')],
-          },
-        }],
-      } as unknown as TSESTree.ObjectExpression;
-      expect(extractAlgorithms(obj)).toEqual(['RS256', 'ES256']);
-    });
-
-    it('should return empty array for no algorithms', () => {
-      const obj = mockObjectExpression({ other: mockLiteral('value') });
-      expect(extractAlgorithms(obj)).toEqual([]);
-    });
-
-    it('should handle alg key', () => {
-      const obj = mockObjectExpression({ alg: mockLiteral('ES512') });
-      expect(extractAlgorithms(obj)).toEqual(['ES512']);
-    });
-
-    it('should skip SpreadElement properties (line 143)', () => {
-      // This covers the `continue` at line 143 for non-Property types
-      const obj = {
-        type: 'ObjectExpression',
-        properties: [
-          { type: 'SpreadElement', argument: { type: 'Identifier', name: 'opts' } },
-          {
-            type: 'Property',
-            key: { type: 'Identifier', name: 'algorithm' },
-            value: mockLiteral('RS256'),
-          },
-        ],
-      } as unknown as TSESTree.ObjectExpression;
-      expect(extractAlgorithms(obj)).toEqual(['RS256']);
-    });
-
-    it('should skip properties with non-identifier keys', () => {
-      // This also covers line 142 - when key.type !== 'Identifier'
-      const obj = {
-        type: 'ObjectExpression',
-        properties: [{
-          type: 'Property',
-          key: { type: 'Literal', value: 'algorithm' }, // Literal key, not Identifier
-          value: mockLiteral('RS256'),
-        }],
-      } as unknown as TSESTree.ObjectExpression;
-      expect(extractAlgorithms(obj)).toEqual([]);
-    });
-  });
-
-  describe('hasOption', () => {
-    it('should return true when option exists', () => {
-      const obj = mockObjectExpression({ expiresIn: mockLiteral('1h') });
-      expect(hasOption(obj, 'expiresIn')).toBe(true);
-    });
-
-    it('should return false when option missing', () => {
-      const obj = mockObjectExpression({});
-      expect(hasOption(obj, 'expiresIn')).toBe(false);
-    });
-  });
-
-  describe('getOptionValue', () => {
-    it('should return option value', () => {
-      const value = mockLiteral('1h');
-      const obj = mockObjectExpression({ expiresIn: value });
-      expect(getOptionValue(obj, 'expiresIn')).toBe(value);
-    });
-
-    it('should return undefined for missing option', () => {
-      const obj = mockObjectExpression({});
-      expect(getOptionValue(obj, 'expiresIn')).toBeUndefined();
-    });
-  });
-
-  describe('isWeakSecret', () => {
-    it('should return true for short secrets', () => {
-      const node = mockLiteral('short');
-      expect(isWeakSecret(node, 32)).toBe(true);
-    });
-
-    it('should return false for long secrets', () => {
-      const node = mockLiteral('a'.repeat(64));
-      expect(isWeakSecret(node, 32)).toBe(false);
-    });
-
-    it('should return false for non-literals', () => {
-      const node = { type: 'Identifier', name: 'secret' } as TSESTree.Identifier;
-      expect(isWeakSecret(node)).toBe(false);
-    });
-  });
-
-  describe('isEnvVariable', () => {
-    it('should return true for process.env.X', () => {
-      const node = {
-        type: 'MemberExpression',
-        object: {
-          type: 'MemberExpression',
-          object: { type: 'Identifier', name: 'process' },
-          property: { type: 'Identifier', name: 'env' },
-        },
-        property: { type: 'Identifier', name: 'JWT_SECRET' },
-      } as unknown as TSESTree.MemberExpression;
-      expect(isEnvVariable(node)).toBe(true);
-    });
-
-    it('should return false for other nodes', () => {
-      const node = { type: 'Identifier', name: 'secret' } as TSESTree.Identifier;
-      expect(isEnvVariable(node)).toBe(false);
-    });
-  });
-
-  describe('operation checkers', () => {
-    it('isSignOperation detects sign calls', () => {
-      expect(isSignOperation(mockCallExpression('sign'))).toBe(true);
-      expect(isSignOperation(mockCallExpression('other'))).toBe(false);
-    });
-
-    it('isVerifyOperation detects verify calls', () => {
-      expect(isVerifyOperation(mockCallExpression('verify'))).toBe(true);
-      expect(isVerifyOperation(mockCallExpression('other'))).toBe(false);
-    });
-
-    it('isDecodeOperation detects decode calls', () => {
-      expect(isDecodeOperation(mockCallExpression('decode'))).toBe(true);
-      expect(isDecodeOperation(mockCallExpression('other'))).toBe(false);
-    });
-  });
-
-  describe('getOptionsArgument', () => {
-    it('should return options object at default index', () => {
-      const options = mockObjectExpression({});
-      const call = {
-        ...mockCallExpression('verify'),
-        arguments: [mockLiteral('token'), mockLiteral('secret'), options],
-      } as unknown as TSESTree.CallExpression;
-      expect(getOptionsArgument(call)).toBe(options);
-    });
-
-    it('should return undefined if no options', () => {
-      const call = mockCallExpression('verify');
-      expect(getOptionsArgument(call)).toBeUndefined();
-    });
-  });
-
-  describe('isTestFile', () => {
-    it('should return true for test files', () => {
-      expect(isTestFile('file.test.ts')).toBe(true);
-      expect(isTestFile('file.spec.js')).toBe(true);
-      expect(isTestFile('/path/__tests__/file.ts')).toBe(true);
-    });
-
-    it('should return false for non-test files', () => {
-      expect(isTestFile('index.ts')).toBe(false);
-      expect(isTestFile('utils.js')).toBe(false);
-    });
-  });
-
-  describe('constants', () => {
-    it('should have sensitive fields', () => {
-      expect(SENSITIVE_PAYLOAD_FIELDS.has('password')).toBe(true);
-      expect(SENSITIVE_PAYLOAD_FIELDS.has('ssn')).toBe(true);
-      expect(SENSITIVE_PAYLOAD_FIELDS.has('api_key')).toBe(true);
-    });
-
-    it('should have symmetric algorithms', () => {
-      expect(SYMMETRIC_ALGORITHMS.has('HS256')).toBe(true);
-    });
-
-    it('should have secure algorithms', () => {
-      expect(SECURE_ALGORITHMS.has('RS256')).toBe(true);
-      expect(SECURE_ALGORITHMS.has('ES256')).toBe(true);
-    });
-
-    it('should have insecure algorithms', () => {
-      expect(INSECURE_ALGORITHMS.has('none')).toBe(true);
-    });
-
-    it('should have JWT libraries', () => {
-      expect(JWT_LIBRARIES.JSONWEBTOKEN).toBe('jsonwebtoken');
-      expect(JWT_LIBRARIES.JOSE).toBe('jose');
-    });
-  });
-});